Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Log4j exploit was used in a cyberattack against the Belgian Defense Ministry. The ministry’s activities were halted for many days following the cyberattack
“Defense on Thursday discovered an attack on its computer network with internet access,” said a military spokesman.
Apache Log4j is a Java-based logging utility that is widely used in applications around the world. On December 9th, 2021, the working Proof of Concept for the RCE (Remote Code Execution) vulnerability in Apache Log4j 2 was released publicly. Within 2 hours, attackers began the exploitation of the vulnerability and widespread internet scanning began to find vulnerable assets and instances of log4j.
State-sponsored APT (Advanced Persistent Threat) groups from China, Turkey, North Korea, and Iran have been actively attempting to exploit the vulnerability. The same threat actors exploited the log4j vulnerabilities to carry out this attack against the Belgian Defense Ministry
Version 2.16.0 has been released without the vulnerability. Upgrade to Log4j Version 2.16.0.
If upgrading to version 2.16.0 is not possible at the moment, then the following workarounds can be done for mitigating the vulnerability:
As the lookups are done using the Java packages for JNDI API (com.sun.JNDI.ldap.object.trustURLCodebase) or by (InitialContext().lookup(“lookup address”)) by creating an instance using (org.apache.naming.factory.BeanFactory), we have to disable the lookups functionality for the remote serves to mitigate the vulnerability.
Version 2.16.0 has been released without the vulnerability. Upgrade to Log4j Version 2.16.0.
If upgrading to version 2.16.0 is not possible at the moment, then the following workarounds can be done for mitigating the vulnerability.
Upgrade to the latest version of Apache Log4j, available from the Apache Web site.
Upgrade to the latest version of Log4j, available from the Apache Web site.
Here’s a repository containing all the affected and unaffected vendors and software that are affected by the log4j vulnerability along with their patches.
Like the Log4j exploits, the WebSocket attack vector is resilient and silent and therefore detection is fairly difficult. However, here are a few methods to detect and remediate the attacks in your environment: